CVE-2026-44836: ViewComponent Preview Route RCE Vulnerability

CVE-2026-44836 Overview

CVE-2026-44836 affects view_component, a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. The vulnerability exists in versions 3.0.0 through 4.9.0 and stems from improper restriction of route-reachable methods on ViewComponent::Preview [CWE-749]. The preview route derives an example name from the URL and invokes it via public_send without verifying that the requested method is one of the preview examples explicitly defined by the preview class. Attackers with access to exposed preview routes can invoke inherited public methods, including render_with_template, to render internal Rails templates that are not otherwise routable.

Critical Impact
An authenticated attacker can reach unintended Rails templates by supplying attacker-controlled template: and locals: parameters through the preview route, leading to information disclosure.

Affected Products

view_component gem versions 3.0.0 through 4.8.x
Ruby on Rails applications exposing ViewComponent previews in production or staging
Applications relying on default preview route configuration

Discovery Timeline

2026-05-26 - CVE-2026-44836 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-44836

Vulnerability Analysis

The view_component preview controller extracts an example name from the request URL and dispatches it on the preview class using public_send. The dispatcher does not validate that the requested method belongs to the set of preview examples defined by the developer. Any public method inherited from ViewComponent::Preview becomes reachable through the preview route.

The most consequential inherited method is render_with_template. This method accepts template: and locals: keyword arguments, which originate from request parameters. The values are passed directly to Rails as render template:, allowing an attacker to instruct the application to render arbitrary internal templates. These templates may include partials, layouts, or mailer views that the application never intended to expose through HTTP.

The issue is classified under [CWE-749] (Exposed Dangerous Method or Function). Because the attack surface depends on whether previews are exposed, production deployments that disable previews are not affected. Staging environments and applications that intentionally expose previews behind weak authentication face the highest exposure.

Root Cause

The root cause is missing allowlist validation before method dispatch. The preview controller treats any public method on the preview class as a legitimate example. Inherited helpers from ViewComponent::Preview are not filtered out, so framework-provided methods become indirect entry points for template rendering.

Attack Vector

An attacker sends an HTTP request to the preview route, substituting the example name segment with render_with_template and supplying template and locals query parameters. The controller dispatches the method, and Rails renders the attacker-specified template using the supplied locals. The vulnerability requires network access and low privileges, with no user interaction needed.

The vulnerability mechanism is documented in the GitHub Security Advisory GHSA-7f3r-gwc9-2995. No verified public proof-of-concept code is available at this time.

Detection Methods for CVE-2026-44836

Indicators of Compromise

HTTP requests to /rails/view_components/* or custom preview mount paths containing render_with_template in the URL path
Preview route requests with template or locals query parameters or form fields
Unexpected rendering of internal partials, mailer templates, or admin views in application logs
Access to preview endpoints from non-developer IP ranges or outside maintenance windows

Detection Strategies

Inspect web server and Rails logs for preview route requests where the action segment does not match a defined preview example method
Alert on any preview route request containing template= or locals[ parameters
Audit running Gemfile.lock entries for view_component versions below 4.9.0 across all environments

Monitoring Recommendations

Forward Rails application logs and reverse proxy logs to a central SIEM and create rules for preview route abuse patterns
Track 200 OK responses on preview endpoints that reference template paths outside the previews directory
Monitor authentication logs for unusual access to staging or development hosts that expose previews

How to Mitigate CVE-2026-44836

Immediate Actions Required

Upgrade the view_component gem to version 4.9.0 or later in all environments
Disable preview routes in production by setting config.view_component.show_previews = false
Restrict access to preview routes with authentication middleware or network-level controls
Review application logs for prior abuse of render_with_template through preview URLs

Patch Information

The vulnerability is fixed in view_component version 4.9.0. The patched release enforces an allowlist check so the preview controller only dispatches methods explicitly defined as preview examples by the developer. Update the gem entry in Gemfile, run bundle update view_component, and redeploy. See the GitHub Security Advisory for complete remediation guidance.

Workarounds

Disable preview rendering entirely in production environments where previews are not required
Place preview routes behind authenticated admin sessions and IP allowlists until patching is complete
Add a before_action filter in a custom preview controller that rejects requests whose action name is not in the explicit preview examples list

bash

# Configuration example
# config/environments/production.rb
Rails.application.configure do
  config.view_component.show_previews = false
end

# Update Gemfile
# gem "view_component", "~> 4.9.0"
bundle update view_component